PCI DSS v4.0 requirement 12.6: security awareness training explained

If your organization stores, processes or transmits payment card data, PCI DSS sets some of the most specific security awareness requirements of any framework. Version 4.0 made them stricter, and the last of the new requirements became mandatory on March 31, 2025.

This article walks through requirement 12.6 in plain language. It is not a substitute for the standard itself or your Qualified Security Assessor’s view.

The requirements

12.6.1: a formal program. You need a formal security awareness program that makes all personnel aware of your information security policy and procedures, and their role in protecting cardholder data.

12.6.2: review it every year. The program must be reviewed at least once every 12 months and updated as needed to address new threats and vulnerabilities that could affect the security of your cardholder data environment.

12.6.3: train on hire and at least every 12 months. Personnel receive security awareness training when they are hired and at least once every 12 months after that. Multiple methods can be used. Personnel must also acknowledge, at least once every 12 months, that they have read and understood your security policies and procedures.

12.6.3.1: cover phishing and social engineering. Training must include awareness of threats and vulnerabilities that could affect the cardholder data environment, including phishing and related attacks and social engineering.

12.6.3.2: cover acceptable use. Training must include awareness of the acceptable use of end-user technologies, in line with requirement 12.2.1.

Who counts as personnel

PCI DSS uses “personnel” broadly: full-time and part-time employees, temporary staff, contractors and consultants who work on your premises or otherwise have access to the cardholder data environment. Your assessor will expect everyone in scope to have training records, not just the IT team.

What your assessor will ask for

• The documented awareness program and evidence of its annual review
• Training content, showing phishing, social engineering and acceptable use
• Records showing each person was trained on hire and within the last 12 months
• Signed or recorded acknowledgments of the security policy

Make it stick

The standard sets a minimum of once a year, but phishing techniques change much faster than that. Short, regular sessions keep the content current and give you a continuous record instead of a scramble before each assessment.

How Genbay helps

Genbay’s cybersecurity awareness training covers phishing, social engineering, safe access and data handling in live sessions that run all year. Your people join every session their plan covers, and the Evidence and Total Upskill plans give you attendance reports, quizzes and verifiable certificates for your assessor. See pricing.

Sources

• PCI DSS document library, PCI Security Standards Council

This article is general information, not legal advice. Requirements change; check the current text of each framework and confirm your obligations with your auditor or counsel.